12 ms·

Torrent P2P microblogging

127 points by ianso 13y ago

lcasela 13y ago
Nice, how secure is it though?
- nashashmi 13y ago
  From an anonymity perspective, it is just as secure as current bitcoin protocols. Public anonymity at the sacrifice of privacy. In which case, if your 'twister' info is out there, you can theoretically be identified.
  - betterunix 13y ago
    In other words, the security is poorly defined and based on the honest parties devoting at least as much energy to defending the system as the attacker devotes to attacking it. What I want to know is this: What does Bitcoin have to do with this? You can have peer to peer, anonymous, encrypted messaging without any of the nonsense that Bitcoin entails.
    - ianso 13y ago
      I think the BtC protocol was used to ensure that peoples usernames were guaranteed unique, and linkable to a private key, i.e. verifiable. I think the whitepaper has more info, reading it now: http://arxiv.org/abs/1312.7152 http://arxiv.org/abs/1312.7152
    - salient 13y ago
      From what I can tell its main focus is not to be an alternative to Tor, but a censorship-resistant P2P Twitter alternative. Or if you will, a "true" P2P social network (Diaspora, Status.net always relied on federated servers, which weren't that "decentralized", and normal users would've never hosted their own servers anyway).
      - dublinben 13y ago
        Like Tahrir?
    - sln 13y ago
      Basically, if you have anonymous, P2P, encrypted messaging you need to solve the problem of maintaining a public ledger of user names to public keys. There are several approaches to this, but one of the most compelling right now is using the exact same mechanism that bitcoin uses to prevent double spending. Twister has absolutely nothing to do with bitcoin, they are only similar in that double-spending a bitcoin is analogous to identity theft in Twister.
      - betterunix 13y ago
        "the problem of maintaining a public ledger of user names to public keys" What is the point of that ledger? Public keys identify users on their own.
        sln 13y ago
        Yes they do but 1) most people are more comfortable dealing with usernames compared to public keys, and 2) distributing the public keys themselves can be tricky if you don't already have a trusted connection set up (just look at past abuses of Certificate Authorities for examples of this).
        betterunix 13y ago
        I do not see how distributing keys is "tricky" in this context. If you do not know who you are communicating with, then a man in the middle attack works if the attack occurs during your first attempt to communicate (think SSH); this would seem to be true regardless of the existence of a ledger, since you need to figure out which username you want to communicate with. If you do know who you are communicating with, you can distribute keys offline (e.g. "contact me with $key") or establish keys via some existing communication channel (OTR, PGP, whatever), just as you would have to distribute your username offline or via another channel given the ledger. So sure, I can grant people are more comfortable dealing with usernames than with public keys, but that sounds more like a UI problem than a technology problem. People are certainly capable of dealing with Tor hidden service addresses, and I suspect that is because they are already using a UI they know well (their web browser).
- jokoon 13y ago
  Simple question, many answers. Also, don't ask this question so soon, it takes time to review code, and even more time to find vulnerabilities and come up with working exploits. Second also, P2P system inner working are much more complex, and can be vulnerable to some other types of attacks which are specific to P2P protocols. Having decent P2P security is not really easy. P2P is really exciting, and the advantages are great, but I don't know the specifics of P2P security. Bittorrent and bitcoin can seem simple compared to a P2P messaging program. TLDR: It's the future, but it's not exactly there yet. I'd still use it with those vulnerabilities though.
nashashmi 13y ago
Doesn't that make this service website independent? It is like twitter without the downtime, or twitter with multiple twitter networks all being able to collaborate with one another, or twitter without legal BS. And those are beautiful ramifications. Flaws anyone?
- toyg 13y ago
  It's also twitter without "delete" and twitter without private accounts, from what I can see skimming the whitepaper.
VLM 13y ago
"send text posts limited to 140 characters" That's just weird. Like putting horses reins on an early automobile, or putting a hopper in the front of the car to pour oats into. "Bitcoin, in the sense of the digital currency, is not used at all" I had to LOL at this. BTC is popular enough to try to piggyback completely unrelated things using the term as a lure. I've lived thru the "turbo" era, the "e-" and "i-" era and now we're entering the BTC era, where we can soon expect shampoos and hamburgers to be "BTC shampoo" and "BTC hamburgers" as a marketing gimmick.
- Touche 13y ago
  The project is a fork of bitcoin, uses bitcoin blockchains, but because it doesn't use bitcoin currency they shouldn't mention the lineage?
  - VLM 13y ago
    Yes, at least not as a marketing scheme. So this is a competitor of coinbase? Oh you mean its a miner. Oh no wait OK its like paypal but for BTC. So... they copied some general source code concepts? Thats it? What a scam. Thats not real bitcoin support at all. Its like saying a new game is internet compatible, in that if you install it on an internet connected computer its not incompatible with the OS. I actually saw this kind of thing during the early years of mass adoption of the internet. And now we'll see it in BTC.
    - Touche 13y ago
      You misunderstand, this project is literally a fork of the bitcoin repo. They didn't just "copy general source code concepts". It's right there on their about page.
      - VLM 13y ago
        "the implementation of the neat idea of block chain is on the basis of twister." MS Excel uses do...while loops, my latest project uses do...while loops, therefore my project is based on Excel. I was reading it as algorithm use not literally forking the codebase as appears to be the case. Not everything using Quicksort is a kissing cousin of everything else using Quicksort, for example. Its still cheesy as a marketing scheme. This thing's bitcoin, that means its a currency, right, or a funds storage system, or a psuedobank, or .. oh its a microblog service. LAME. From a tech perspective I think its cool as an unusual use of the algorithm and technology.
Touche 13y ago
Read the whitepaper and it sounds pretty amazing. The one downside is the spam messages, which they say are important to the security of the network, and that clients cannot hide them, but don't explain a method to prevent clients from hiding them. If they really are essential to the security of the network then there needs to be more than shaming, right?
davepeck 13y ago
I couldn't find the whitepaper link. Anyone?
- jjsz 13y ago
  http://arxiv.org/pdf/1312.7152v1.pdf http://arxiv.org/pdf/1312.7152v1.pdf >http://www.reddit.com/r/darknetplan/comments/1u1x56/ http://www.reddit.com/r/darknetplan/comments/1u1x56/
  - davepeck 13y ago
    Thanks.
gasull 13y ago
You can accomplish the same with Bitmessage broadcast addresses, and it solves the spam issue with proof of work. https://bitmessage.org/ https://bitmessage.org/
- Joeboy 13y ago
  I don't know much about Bitmessage, but aren't messages dropped after two days? So a new follower / visitor would only see two days' worth of my microblog?
  - salient 13y ago
    Yes. I would disregard comparisons with BitMessage. I don't think they really target the same market. BitMessage wants to be more of a private snooping-free e-mail system. Twister wants to be more of a public decentralized social network (resistant to censorship). There may be some technical overlap and functionality overlap, but I think they are more different than similar. It's like saying Gmail is the same as Twitter, since you can also broadcast messages with Gmail, and you can also send private messages with Twitter. But the two really aren't the same.
math0ne 13y ago
Cool, but why not make the first client a web based one so we can all it work?
- Joeboy 13y ago
  Isn't that what https://github.com/miguelfreitas/twister-html/ https://github.com/miguelfreitas/twister-html/ is?
Groxx 13y ago
>No IP recording The IP address you use to access twister is not recorded on any server. Your online presence is not announced. Can you really make that claim with a distributed protocol? Your IP address is visible to whoever you send data to, they could easily keep logs (heck my router does by default).
- dionyziz 13y ago
  Your peers cannot know if the data originated from you or you're simply relaying traffic. Thus, your IP address cannot be associated with tweets.
  - TheLoneWolfling 13y ago
    Untrue. An (for example) ISP could very easily determine if you were an originator simply by if someone relayed it to you. Similarly, a Sybil attack can probabilistically figure out the originator, simply be seeing which peer first relayed the communication.
    - Groxx 13y ago
      This is about what I was thinking. Tor avoids some of the ISP-problems by re-encrypting at every step (so you can't correlate input and output, except by time/size, which is hard on a busy node). After poking through the FAQ the claim softens quite a bit, into that "normal" users can't detect such things. This I'll grant is true. And they even mention that, if hiding from adversaries who can observe lots of traffic, you should probably use Tor. That said, the FAQ does say: >However if one entity is capable of recording the entire internet traffic, he will probably be able to at least statistically sort out where you are connecting from (your IP address). which I think I'll still disagree with, unless this is provided by DHT (I don't know DHT, sadly. I'll remedy this some day). Unless you run through Tor, it seems(?) like all messages are essentially plaintext across the internet, so they would know exactly where a message originated, if you're within their view.
foobarqux 13y ago
This isn't the right problem to be fixing: The right problem is a distributed data store.
deleted 13y ago
[deleted]
dionyziz 13y ago
Another win against Zooko's conjecture!
codezero 13y ago
Is there any follow model or does every participant receive all messages sent by everyone else?
- quack 13y ago
  Everyone gets every message. There is no solution here to the data bloat problem. Other than that the project forks bitcoin to make a namecoin clone (distributed authorization), which I dont see the need for since a private key already identifies me. The reason something like namecoin is to allow people to update their identity in the event the first identity was compromised/blocked. Finally this was posted yesterday https://news.ycombinator.com/item?id=6987396 https://news.ycombinator.com/item?id=6987396
  - codezero 13y ago
    Thanks a bunch for your response. I guess an end user could always filter messages themselves, but it seems untenable at large scales.
  - sln 13y ago
    This is not true. Followers are established by connecting to bittorrent swarms. From the paper: "The last network is a collection of possibly disjoint “swarms” of followers, based on the Bittorrent protocol, which can be used for efficient near-instant notification delivery to many users." Furthermore, not all clients need to store and reseed all messages they receive. More seeders is obviously better for network health, but it's not always a reasonable option. The paper suggests that clients can choose to be "achivists" which means that they keep messages and seed them to others (so it's optional). Clients like mobile phones could easily disable this behavior. Also Twister can't use Namecoin because the incentives are wrong. In Namecoin, miners get to create domains. It would be horrible if only Twister miners could make accounts. Instead they get to make promoted posts, so it has to be a separate implementation.
- sln 13y ago
  Followers are established by connecting to bittorrent swarms. From the paper: "The last network is a collection of possibly disjoint “swarms” of followers, based on the Bittorrent protocol, which can be used for efficient near-instant notification delivery to many users." Furthermore, not all clients need to store and reseed all messages they receive. More seeders is obviously better for network health, but it's not always a reasonable option. The paper suggests that clients can choose to be "achivists" which means that they keep messages and seed them to others (so it's optional). Clients like mobile phones could easily disable this behavior.
nwzpaperman 13y ago
Everyone needs to remember that TCP/IP is the original decentralized communication system. The raw CPU power, massive storage capabilities and physical infrastructure that we have today makes mass surveillance a trivial objective going forward. The rest of the world has just realized and accepted this and that's why the NSA has come under attack in 2013. No expects to privately have sex on the 50 yard-line at half-time of the Super Bowl. Why not? Everyone expects to privately sext-message, or whatever, on radio frequencies. Why? Most people here probably understand encapsulation, so why is it so hard to grasp that private activities and private information needs to be restricted to private modes, mediums and forums for communication? When the smartest people in this community turn the corner and approach the internet as an unprivate place and refocus their creative talents towards increasing the signal-to-noise ratio of the public information, it will be a landmark-shift for society. The world absolutely needs a way to access timely public information that doesn't require running through bureaucracies prior to meaningful distribution. People learned how to read and people are now learning to question information sources. BTC establishes trust through transparency, not privacy. The next big internet trend is transparency == Who? What? When? Where? Why? How?
mrcactu5 13y ago
are there other open source versions of Twitter? I could gladly use this one if I could embed mathematical equations in it - e.g. with mathJax http://www.mathjax.org/ http://www.mathjax.org/ - and possibly lift the 140 character limit.
robgibbons 13y ago
I need at least one more /buzzword in the title before I use it.
alpinesol 13y ago
The incentive to 'mine' in this scheme is the possibility of winning the ability to send a sponsored message to all users. These sponsored messages could easily be filtered by users, making them worthless. Even if users collectively agree not to filter the sponsored messages, the average cost of winning the proof-of-work race must be less than the average value of the sponsored messages, which is unlikely.

127 points by ianso 13y ago

lcasela 13y ago

Nice, how secure is it though?

nashashmi 13y ago
From an anonymity perspective, it is just as secure as current bitcoin protocols. Public anonymity at the sacrifice of privacy. In which case, if your 'twister' info is out there, you can theoretically be identified.
- betterunix 13y ago
  In other words, the security is poorly defined and based on the honest parties devoting at least as much energy to defending the system as the attacker devotes to attacking it. What I want to know is this: What does Bitcoin have to do with this? You can have peer to peer, anonymous, encrypted messaging without any of the nonsense that Bitcoin entails.
  - ianso 13y ago
    I think the BtC protocol was used to ensure that peoples usernames were guaranteed unique, and linkable to a private key, i.e. verifiable. I think the whitepaper has more info, reading it now: http://arxiv.org/abs/1312.7152 http://arxiv.org/abs/1312.7152
  - salient 13y ago
    From what I can tell its main focus is not to be an alternative to Tor, but a censorship-resistant P2P Twitter alternative. Or if you will, a "true" P2P social network (Diaspora, Status.net always relied on federated servers, which weren't that "decentralized", and normal users would've never hosted their own servers anyway).
    - dublinben 13y ago
      Like Tahrir?
  - sln 13y ago
    Basically, if you have anonymous, P2P, encrypted messaging you need to solve the problem of maintaining a public ledger of user names to public keys. There are several approaches to this, but one of the most compelling right now is using the exact same mechanism that bitcoin uses to prevent double spending. Twister has absolutely nothing to do with bitcoin, they are only similar in that double-spending a bitcoin is analogous to identity theft in Twister.
    - betterunix 13y ago
      "the problem of maintaining a public ledger of user names to public keys" What is the point of that ledger? Public keys identify users on their own.
      - sln 13y ago
        Yes they do but 1) most people are more comfortable dealing with usernames compared to public keys, and 2) distributing the public keys themselves can be tricky if you don't already have a trusted connection set up (just look at past abuses of Certificate Authorities for examples of this).
        betterunix 13y ago
        I do not see how distributing keys is "tricky" in this context. If you do not know who you are communicating with, then a man in the middle attack works if the attack occurs during your first attempt to communicate (think SSH); this would seem to be true regardless of the existence of a ledger, since you need to figure out which username you want to communicate with. If you do know who you are communicating with, you can distribute keys offline (e.g. "contact me with $key") or establish keys via some existing communication channel (OTR, PGP, whatever), just as you would have to distribute your username offline or via another channel given the ledger. So sure, I can grant people are more comfortable dealing with usernames than with public keys, but that sounds more like a UI problem than a technology problem. People are certainly capable of dealing with Tor hidden service addresses, and I suspect that is because they are already using a UI they know well (their web browser).
jokoon 13y ago
Simple question, many answers. Also, don't ask this question so soon, it takes time to review code, and even more time to find vulnerabilities and come up with working exploits. Second also, P2P system inner working are much more complex, and can be vulnerable to some other types of attacks which are specific to P2P protocols. Having decent P2P security is not really easy. P2P is really exciting, and the advantages are great, but I don't know the specifics of P2P security. Bittorrent and bitcoin can seem simple compared to a P2P messaging program. TLDR: It's the future, but it's not exactly there yet. I'd still use it with those vulnerabilities though.

nashashmi 13y ago

Doesn't that make this service website independent? It is like twitter without the downtime, or twitter with multiple twitter networks all being able to collaborate with one another, or twitter without legal BS. And those are beautiful ramifications. Flaws anyone?

toyg 13y ago
It's also twitter without "delete" and twitter without private accounts, from what I can see skimming the whitepaper.

VLM 13y ago

"send text posts limited to 140 characters" That's just weird. Like putting horses reins on an early automobile, or putting a hopper in the front of the car to pour oats into. "Bitcoin, in the sense of the digital currency, is not used at all" I had to LOL at this. BTC is popular enough to try to piggyback completely unrelated things using the term as a lure. I've lived thru the "turbo" era, the "e-" and "i-" era and now we're entering the BTC era, where we can soon expect shampoos and hamburgers to be "BTC shampoo" and "BTC hamburgers" as a marketing gimmick.

Touche 13y ago
The project is a fork of bitcoin, uses bitcoin blockchains, but because it doesn't use bitcoin currency they shouldn't mention the lineage?
- VLM 13y ago
  Yes, at least not as a marketing scheme. So this is a competitor of coinbase? Oh you mean its a miner. Oh no wait OK its like paypal but for BTC. So... they copied some general source code concepts? Thats it? What a scam. Thats not real bitcoin support at all. Its like saying a new game is internet compatible, in that if you install it on an internet connected computer its not incompatible with the OS. I actually saw this kind of thing during the early years of mass adoption of the internet. And now we'll see it in BTC.
  - Touche 13y ago
    You misunderstand, this project is literally a fork of the bitcoin repo. They didn't just "copy general source code concepts". It's right there on their about page.
    - VLM 13y ago
      "the implementation of the neat idea of block chain is on the basis of twister." MS Excel uses do...while loops, my latest project uses do...while loops, therefore my project is based on Excel. I was reading it as algorithm use not literally forking the codebase as appears to be the case. Not everything using Quicksort is a kissing cousin of everything else using Quicksort, for example. Its still cheesy as a marketing scheme. This thing's bitcoin, that means its a currency, right, or a funds storage system, or a psuedobank, or .. oh its a microblog service. LAME. From a tech perspective I think its cool as an unusual use of the algorithm and technology.

Touche 13y ago

Read the whitepaper and it sounds pretty amazing. The one downside is the spam messages, which they say are important to the security of the network, and that clients cannot hide them, but don't explain a method to prevent clients from hiding them. If they really are essential to the security of the network then there needs to be more than shaming, right?

davepeck 13y ago

I couldn't find the whitepaper link. Anyone?

jjsz 13y ago
http://arxiv.org/pdf/1312.7152v1.pdf http://arxiv.org/pdf/1312.7152v1.pdf >http://www.reddit.com/r/darknetplan/comments/1u1x56/ http://www.reddit.com/r/darknetplan/comments/1u1x56/
- davepeck 13y ago
  Thanks.

gasull 13y ago

You can accomplish the same with Bitmessage broadcast addresses, and it solves the spam issue with proof of work. https://bitmessage.org/ https://bitmessage.org/

Joeboy 13y ago
I don't know much about Bitmessage, but aren't messages dropped after two days? So a new follower / visitor would only see two days' worth of my microblog?
- salient 13y ago
  Yes. I would disregard comparisons with BitMessage. I don't think they really target the same market. BitMessage wants to be more of a private snooping-free e-mail system. Twister wants to be more of a public decentralized social network (resistant to censorship). There may be some technical overlap and functionality overlap, but I think they are more different than similar. It's like saying Gmail is the same as Twitter, since you can also broadcast messages with Gmail, and you can also send private messages with Twitter. But the two really aren't the same.

math0ne 13y ago

Cool, but why not make the first client a web based one so we can all it work?

Joeboy 13y ago
Isn't that what https://github.com/miguelfreitas/twister-html/ https://github.com/miguelfreitas/twister-html/ is?

Groxx 13y ago

>No IP recording The IP address you use to access twister is not recorded on any server. Your online presence is not announced. Can you really make that claim with a distributed protocol? Your IP address is visible to whoever you send data to, they could easily keep logs (heck my router does by default).

dionyziz 13y ago
Your peers cannot know if the data originated from you or you're simply relaying traffic. Thus, your IP address cannot be associated with tweets.
- TheLoneWolfling 13y ago
  Untrue. An (for example) ISP could very easily determine if you were an originator simply by if someone relayed it to you. Similarly, a Sybil attack can probabilistically figure out the originator, simply be seeing which peer first relayed the communication.
  - Groxx 13y ago
    This is about what I was thinking. Tor avoids some of the ISP-problems by re-encrypting at every step (so you can't correlate input and output, except by time/size, which is hard on a busy node). After poking through the FAQ the claim softens quite a bit, into that "normal" users can't detect such things. This I'll grant is true. And they even mention that, if hiding from adversaries who can observe lots of traffic, you should probably use Tor. That said, the FAQ does say: >However if one entity is capable of recording the entire internet traffic, he will probably be able to at least statistically sort out where you are connecting from (your IP address). which I think I'll still disagree with, unless this is provided by DHT (I don't know DHT, sadly. I'll remedy this some day). Unless you run through Tor, it seems(?) like all messages are essentially plaintext across the internet, so they would know exactly where a message originated, if you're within their view.

foobarqux 13y ago

This isn't the right problem to be fixing: The right problem is a distributed data store.

deleted 13y ago

[deleted]

dionyziz 13y ago

Another win against Zooko's conjecture!

codezero 13y ago

Is there any follow model or does every participant receive all messages sent by everyone else?

quack 13y ago
Everyone gets every message. There is no solution here to the data bloat problem. Other than that the project forks bitcoin to make a namecoin clone (distributed authorization), which I dont see the need for since a private key already identifies me. The reason something like namecoin is to allow people to update their identity in the event the first identity was compromised/blocked. Finally this was posted yesterday https://news.ycombinator.com/item?id=6987396 https://news.ycombinator.com/item?id=6987396
- codezero 13y ago
  Thanks a bunch for your response. I guess an end user could always filter messages themselves, but it seems untenable at large scales.
- sln 13y ago
  This is not true. Followers are established by connecting to bittorrent swarms. From the paper: "The last network is a collection of possibly disjoint “swarms” of followers, based on the Bittorrent protocol, which can be used for efficient near-instant notification delivery to many users." Furthermore, not all clients need to store and reseed all messages they receive. More seeders is obviously better for network health, but it's not always a reasonable option. The paper suggests that clients can choose to be "achivists" which means that they keep messages and seed them to others (so it's optional). Clients like mobile phones could easily disable this behavior. Also Twister can't use Namecoin because the incentives are wrong. In Namecoin, miners get to create domains. It would be horrible if only Twister miners could make accounts. Instead they get to make promoted posts, so it has to be a separate implementation.
sln 13y ago
Followers are established by connecting to bittorrent swarms. From the paper: "The last network is a collection of possibly disjoint “swarms” of followers, based on the Bittorrent protocol, which can be used for efficient near-instant notification delivery to many users." Furthermore, not all clients need to store and reseed all messages they receive. More seeders is obviously better for network health, but it's not always a reasonable option. The paper suggests that clients can choose to be "achivists" which means that they keep messages and seed them to others (so it's optional). Clients like mobile phones could easily disable this behavior.

nwzpaperman 13y ago

Everyone needs to remember that TCP/IP is the original decentralized communication system. The raw CPU power, massive storage capabilities and physical infrastructure that we have today makes mass surveillance a trivial objective going forward. The rest of the world has just realized and accepted this and that's why the NSA has come under attack in 2013. No expects to privately have sex on the 50 yard-line at half-time of the Super Bowl. Why not? Everyone expects to privately sext-message, or whatever, on radio frequencies. Why? Most people here probably understand encapsulation, so why is it so hard to grasp that private activities and private information needs to be restricted to private modes, mediums and forums for communication? When the smartest people in this community turn the corner and approach the internet as an unprivate place and refocus their creative talents towards increasing the signal-to-noise ratio of the public information, it will be a landmark-shift for society. The world absolutely needs a way to access timely public information that doesn't require running through bureaucracies prior to meaningful distribution. People learned how to read and people are now learning to question information sources. BTC establishes trust through transparency, not privacy. The next big internet trend is transparency == Who? What? When? Where? Why? How?

mrcactu5 13y ago

are there other open source versions of Twitter? I could gladly use this one if I could embed mathematical equations in it - e.g. with mathJax http://www.mathjax.org/ http://www.mathjax.org/ - and possibly lift the 140 character limit.

robgibbons 13y ago

I need at least one more /buzzword in the title before I use it.

alpinesol 13y ago

The incentive to 'mine' in this scheme is the possibility of winning the ability to send a sponsored message to all users. These sponsored messages could easily be filtered by users, making them worthless. Even if users collectively agree not to filter the sponsored messages, the average cost of winning the proof-of-work race must be less than the average value of the sponsored messages, which is unlikely.